SB20260928100 - Race condition in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98101)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause IPv6 multicast packets to be evaluated against incorrect source filters.

The vulnerability exists due to a race condition in the ip6_mc_source() IPv6 multicast source-filter handling function when source filters are modified concurrently with packet reception. A local user can concurrently add or remove IPv6 multicast source filters to cause IPv6 multicast packets to be evaluated against incorrect source filters.

The race affects UDP and raw multicast receive paths.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/20db91a052332ef5552bd2f651ffb9db911cf67b
• https://git.kernel.org/stable/c/2c2091e2ee93049fc513ad1e6c99d8b6c809f467
• https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1